Hysteria 2 vs VLESS Reality

Hysteria 2 is faster on unstable networks and mobile data. VLESS Reality is stealthier and gets through where UDP is blocked. Both protocols come in the same Lunaire subscription, and the client switches between them on its own.

The main difference is transport. Hysteria 2 runs only over UDP, on top of the QUIC stack. VLESS Reality runs over TCP/443. Everything else follows from that: whether the connection survives a firewall, how quickly it comes up, how it behaves when packets are lost.

UDP guarantees nothing on its own — it is just datagrams. Reliable delivery is built on top by QUIC, and it works differently from classic TCP: streams are multiplexed independently, so losing one packet doesn't hold up the others, and reconnecting to a server you've already used skips a round trip.

TCP guarantees ordered delivery at the operating-system level. Reality uses the standard system stack and adds a TLS 1.3 handshake disguised as a connection to an external domain. It takes longer to establish than QUIC, but it is more compatible: TCP on port 443 is let through almost everywhere.

Hysteria 2 uses Brutal, a congestion control algorithm of its own. The client tells it the bandwidth it wants — 50 Mbps, say — and Brutal tries to hold that, without treating a lost packet as a sign of congestion. The one thing that does make it slow down is rising RTT, which is what a genuinely saturated link looks like.

VLESS Reality runs over TCP, so speed is governed by the server kernel's congestion control; on our nodes that is BBR v3. The difference isn't that one algorithm beats the other — it is where the decision is made and on what signal. For Hysteria 2 that happens inside the protocol, against a target the user set. For Reality it happens in the kernel, under the same rules as all other TCP traffic.

On a clean link the difference is barely visible. It shows up where packets are lost: algorithms that read loss as congestion back off, and Brutal does not.

Reality wins this one by a wide margin. The TLS handshake of a Reality connection is indistinguishable from a handshake with a real domain: the server presents an external site's certificate — Microsoft, Apple, Cloudflare — the SNI matches, and the TLS version and cipher suite are the standard ones. Even TLS fingerprinting systems such as JA3 and JA4 see ordinary HTTPS.

Hysteria 2 is stealthy too, just less absolutely. It looks like QUIC and uses real TLS 1.3, but QUIC as a traffic category draws attention from classifiers more often than familiar HTTPS does.

QUIC supports 0-RTT resumption: if the client has connected to this server before, the reconnection costs no extra round trip — the data goes out together with the handshake. On mobile networks, where the connection drops and comes back constantly, that is noticeable: Hysteria 2 returns almost instantly.

Reality takes the longer path. First the TCP handshake, then TLS 1.3 — two full round trips before the first byte of data. On a stable link that delay happens once and you barely feel it; on an unstable one it repeats at every reconnection.

Pitting Hysteria 2 against VLESS Reality is a false dilemma. They solve different problems rather than compete: one holds speed where the network drops packets, the other gets through where the first won't come up at all. The sensible answer is to run both and switch automatically. That is how the Lunaire stack is built.